Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:43

General

  • Target

    03497a1a093756aba69a5961c2b96a53378267f82908501f02d697f814114add.exe

  • Size

    1.1MB

  • MD5

    e8dbe5300af3ee3b6c45ec159ca7e638

  • SHA1

    8bf80951366faa9284d017ae84706e191635f445

  • SHA256

    03497a1a093756aba69a5961c2b96a53378267f82908501f02d697f814114add

  • SHA512

    2b2dc74cbf229cc338b6a63460a4e2bfe0ec3e417eb7095287ba1344f03a20b17ecbba26262339f1a83de65bcd6ad15ab34da69c354f8ad711bf385f7ae43bf6

  • SSDEEP

    24576:3ynqRV/GG4cDH31rQPo9eIarXfUB2DeRH:CnSuMDH31UPQeIEXsB2De

Malware Config

Extracted

Family

redline

Botnet

lada

C2

185.161.248.90:4125

Attributes
  • auth_value

    0b3678897547fedafe314eda5a2015ba

Extracted

Family

redline

Botnet

diza

C2

185.161.248.90:4125

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Signatures

  • Detects Healer an antivirus disabler dropper 17 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03497a1a093756aba69a5961c2b96a53378267f82908501f02d697f814114add.exe
    "C:\Users\Admin\AppData\Local\Temp\03497a1a093756aba69a5961c2b96a53378267f82908501f02d697f814114add.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un361175.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un361175.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1480
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un566805.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un566805.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4884
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr378489.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr378489.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4184
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 1088
            5⤵
            • Program crash
            PID:540
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu567557.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu567557.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2740
          • C:\Windows\Temp\1.exe
            "C:\Windows\Temp\1.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5168
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 1164
            5⤵
            • Program crash
            PID:5372
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk284299.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk284299.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5480
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4184 -ip 4184
    1⤵
      PID:4564
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2740 -ip 2740
      1⤵
        PID:5224

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un361175.exe

        Filesize

        851KB

        MD5

        2deeef694cea682c5a747d78512d5411

        SHA1

        74ab45111c8d3900035b800fe4924d8da1738443

        SHA256

        0b34d90f323890521133ff8b517abdb10ee45572cf6b0a8495a9d65fe711bd15

        SHA512

        9968fab6a7ec8ddb3d2fad69b7cf0e35e67107a74a08174b572ecee1373a7e9ba27136ec8ef5a27bfedcb15bd59231d67c3c3d16f9ffe4faf870391b928b2bfd

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk284299.exe

        Filesize

        168KB

        MD5

        c52ebada00a59ec1f651a0e9fbcef2eb

        SHA1

        e1941278df76616f1ca3202ef2a9f99d2592d52f

        SHA256

        35d5cff482e78c0137b3c51556d1e14aab0f38921ebfe46abc979a826301d28e

        SHA512

        6b11124fa6cfa1d2fdb8b6a4cc237b4a65ecbeb1797179568dcef378041ce05bdf0af9b6434cc0b3feb2479112d003b0fa5c0d2178c73bc65d35f5c2cfb36be2

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un566805.exe

        Filesize

        697KB

        MD5

        6e35a44d22586a1a557935770d441667

        SHA1

        78610d5672ddb9513678590ac3c16660f7e61e3b

        SHA256

        74a089d7b97611323e815037ee3a32117107f9c663de043e9f5dd2f6c072f411

        SHA512

        b8e4dea186d4b05c9423b1a28735841e2b370e8e2743317378d8f4104ebf056043db95beb8dc1d199f6f858ec40b91e229235fcc0ff5b53a0d59698abf5a8895

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr378489.exe

        Filesize

        403KB

        MD5

        d6b46c7d689f936feeace8f8e7817089

        SHA1

        ecfe9f816669a07168be203cec68e384376b51aa

        SHA256

        d6175737cc55f7b3291ab2946f6a7b8f87c2336e0ccba3b08fddd2fc16e5986f

        SHA512

        b31d12553b3726b1ceed55003ab9fb4461e5f5443adcc6998f34c47898b22dc72c57aa8d802f88a07dad2df6986497da71519af8725f000132e4ce8bc9da4ddb

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu567557.exe

        Filesize

        586KB

        MD5

        e7921b5a72cf10380a49e0bd175f3739

        SHA1

        7a938329bac518edf9a1e3de46d53762cdc0ba13

        SHA256

        51e3f794608f241c1d181bf91f31f59648646b1adf0ed07bf0c352006e285d62

        SHA512

        95548bf698b1e77c96f08faa6d1bf7e8c72a4777ffc2bffd0d2f55455a4d98ee4e43a3dd58d71d003fa7dcdc3b0eea1baafd6d2ed2ce294c3651cd53ba45a2fa

      • C:\Windows\Temp\1.exe

        Filesize

        168KB

        MD5

        03728fed675bcde5256342183b1d6f27

        SHA1

        d13eace7d3d92f93756504b274777cc269b222a2

        SHA256

        f1181356c69b3dcebadc67d4c751d01164c929eab2b250b83cdedeedd4cd5ef0

        SHA512

        6e2800d2d4e7dcbcbe1842d78029b75d2faa742c8fd7925ae2486396c3dd8c0b8f66e760f3916e42631cde41c0606c48528a4cb779f124b8d28c7af9197c18d1

      • memory/2740-63-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-81-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-91-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-2204-0x0000000005760000-0x0000000005792000-memory.dmp

        Filesize

        200KB

      • memory/2740-87-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-89-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-65-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-67-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-69-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-71-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-73-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-75-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-77-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-79-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-83-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-85-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-93-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-95-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/2740-60-0x0000000002990000-0x00000000029F8000-memory.dmp

        Filesize

        416KB

      • memory/2740-61-0x0000000005550000-0x00000000055B6000-memory.dmp

        Filesize

        408KB

      • memory/2740-62-0x0000000005550000-0x00000000055B0000-memory.dmp

        Filesize

        384KB

      • memory/4184-25-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-24-0x00000000026D0000-0x00000000026E8000-memory.dmp

        Filesize

        96KB

      • memory/4184-36-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-50-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-46-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-53-0x0000000000400000-0x0000000000809000-memory.dmp

        Filesize

        4.0MB

      • memory/4184-26-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-52-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-28-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-30-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-32-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-34-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-38-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-40-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-42-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-55-0x0000000000400000-0x0000000000809000-memory.dmp

        Filesize

        4.0MB

      • memory/4184-44-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-48-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/4184-23-0x0000000004E00000-0x00000000053A4000-memory.dmp

        Filesize

        5.6MB

      • memory/4184-22-0x0000000002590000-0x00000000025AA000-memory.dmp

        Filesize

        104KB

      • memory/5168-2218-0x0000000004D70000-0x0000000004D76000-memory.dmp

        Filesize

        24KB

      • memory/5168-2219-0x0000000005500000-0x0000000005B18000-memory.dmp

        Filesize

        6.1MB

      • memory/5168-2220-0x0000000004FF0000-0x00000000050FA000-memory.dmp

        Filesize

        1.0MB

      • memory/5168-2221-0x0000000004F10000-0x0000000004F22000-memory.dmp

        Filesize

        72KB

      • memory/5168-2222-0x0000000004F70000-0x0000000004FAC000-memory.dmp

        Filesize

        240KB

      • memory/5168-2223-0x0000000005100000-0x000000000514C000-memory.dmp

        Filesize

        304KB

      • memory/5168-2217-0x0000000000590000-0x00000000005BE000-memory.dmp

        Filesize

        184KB

      • memory/5480-2228-0x0000000000F00000-0x0000000000F30000-memory.dmp

        Filesize

        192KB

      • memory/5480-2229-0x0000000003250000-0x0000000003256000-memory.dmp

        Filesize

        24KB